It’s Tuesday morning and your phone buzzes: “Royal Mail: Your package has been held and will not be delivered due to a £1.99 unpaid shipping fee. Pay now to reschedule: [link]” You don’t remember ordering anything, but £1.99 is nothing — and you’d hate for a parcel to be sent back. Your thumb hovers over the link.
Stop. That text is one of the most common Royal Mail scam texts circulating in the UK right now, and clicking it can cost you far more than £1.99. The link opens a convincing copy of Royal Mail’s website, asks for your card details to pay the “fee,” and then either charges your card repeatedly or harvests the details for bigger fraud later. Some versions don’t ask for money at all — they ask you to “confirm your address,” which hands your identity to criminals.
This matters because Royal Mail is one of Britain’s most impersonated brands. Millions of people get genuine Royal Mail texts every day — real tracking updates, real delivery windows — so a fake one blends in perfectly. Scammers know you’re expecting parcels, and they’re counting on you not to look twice at a £2 fee. This guide shows you exactly how to tell a real message from a fake one, what to do if you already clicked, and where to report it.
What a Royal Mail Scam Text Actually Looks Like
The scam texts recycle the same handful of stories, because they work:
The unpaid fee. “Royal Mail: your package has a £2.99 shipping fee, to pay this now visit [link].” Amounts vary — £1.99 and £2.99 are the classics — deliberately small enough that you won’t bother questioning them. The fee is supposedly for underpaid postage, customs, or a redelivery.
The held parcel. “Your package has been held and will not be delivered due to an unpaid shipping fee.” The word “held” creates instant anxiety — something you own is being kept from you — and the fix is one tap away.
The missed delivery. “We attempted to deliver your parcel but you were not in. Reschedule here: [link].” This one doesn’t even ask for money at first. The link leads to a fake tracking page that asks you to “verify your identity” with your full address, date of birth, and card details.
The ready-for-collection text. “Your parcel is ready for collection” with a link to a fake site (past versions have used lookalike domains) where you’re asked to pay before the item is released.
Every version follows the same formula: a plausible delivery story, a small believable fee or a routine verification step, a shortened or lookalike link, and pressure to act now. Royal Mail itself has published warnings telling customers not to click links in these messages and to stay vigilant when a communication arrives that they weren’t expecting.
How the Scam Works, Step by Step
Step 1: The blast. Criminals send the text to tens of thousands of random UK mobile numbers. They don’t know who has a parcel coming — they don’t need to. Enough people are always waiting for something that a percentage will assume it’s theirs.
Step 2: The believable sender. The text may arrive from an ordinary mobile number, or it may appear in the same message thread as genuine Royal Mail texts. Phone networks let senders set the “from” name to anything, so “Royal Mail” on your screen proves nothing. Spoofing the sender name is trivially easy, which is why you should never trust the sender label alone.
Step 3: The lookalike site. The link goes to a page dressed up in Royal Mail’s red branding, with a tracking number pre-filled and a professional-looking payment form. Look closely and the domain is wrong — something like a hyphenated or unfamiliar domain instead of royalmail.com — but on a phone screen, with the browser hiding most of the address bar, most people never check.
Step 4: The harvest. You enter your card details to pay £1.99. The scammer now has your card number, expiry, CVV, name, address, and phone number. The “fee” may never even be charged — the details themselves are the prize, sold on or used for card-not-present fraud. Some victims report small test charges followed by larger ones days later, once the criminals confirm the card works.
Step 5: The follow-up. In some variants, after you pay, the site “confirms” your redelivery and asks for more: a second fee, a “customs surcharge,” your bank login for a “refund.” Each step digs deeper. And because you entered your real phone number, you may now be marked as a responsive target for future scams.
How to Tell a Real Royal Mail Message From a Fake One: 5 Checks
- Never trust the link — go direct instead. This is the only rule you truly need. Don’t tap the link in the text. Open your browser and type royalmail.com yourself (or use the official Royal Mail app if you have it installed), then enter your tracking number there. If there’s a genuine fee, it will show up on the real site. If there’s no tracking number on a real parcel, the text was lying.
- Check the domain of any link you were sent. Real Royal Mail links use royalmail.com. Fake ones use shortened links (bit.ly and similar), hyphenated lookalikes, or unfamiliar domains. On a phone, long-press the link to preview the real destination before deciding anything.
- Ask whether the fee story makes sense. Royal Mail does charge for some things — underpaid postage and customs charges are real — but genuine customs fees come with a grey “Fee to pay” card through your letterbox, not just a text demanding card details. Royal Mail will never ask you to pay a redelivery fee via a text link.
- Look at the sender and the wording. Scam texts often come from random mobile numbers. The wording is usually generic — “Dear customer” rather than your name — and creates pressure: “today only,” “to avoid return,” “final attempt.” Real Royal Mail updates about a tracked parcel reference your actual tracking number.
- Cross-check with what you’re actually expecting. Waiting for nothing? Then a “held parcel” text is automatically suspect. Even if you are expecting something, verify it through the retailer’s own tracking (Amazon, eBay, the sender’s site) rather than the text’s link.
Royal Mail Scam Red Flags
- A fee demanded by text link. The classic sign. Small amounts — £1.99, £2.99 — are chosen to slip under your suspicion threshold.
- A shortened or odd-looking link. bit.ly links and lookalike domains instead of royalmail.com.
- Pressure and deadlines. “Pay within 24 hours or your parcel will be returned.” Real delivery companies don’t hold your parcel hostage over a text.
- Requests for more than a tracker needs. A parcel tracker needs a tracking number. If the page asks for your full card details, date of birth, or bank login, it’s harvesting.
- Generic greetings. “Attention Royal Mail Customer” instead of your name. Royal Mail’s own guidance warns that fraudsters use impersonal greetings and even forge “from” addresses.
- You weren’t expecting a delivery. The scam is sent blind to thousands of numbers. If nothing’s coming, the text answered its own question.
- Spelling and formatting quirks. Not every scam has them anymore — some are flawless — but sloppy English, strange capitalization, or a site that looks “almost right” should still make you pause.
What to Do If You Clicked the Link or Paid
Don’t panic — act quickly, in this order. First, if you entered card details, call your bank now using the number on the back of your card (not any number from the text). Tell them you may have given your details to a phishing site. They can block the card, issue a new one, and watch for fraudulent transactions. If money has already left your account, ask about the chargeback process.
Second, if you entered passwords — especially if you reuse that password anywhere — change them immediately, starting with your email and banking, from a device you trust. Turn on two-factor authentication wherever it’s offered.
Third, if you entered personal details like your address and date of birth, consider registering with the UK’s protective services for identity fraud. Keep an eye on your credit report for accounts you didn’t open.
Fourth, report it (details below). Reporting a phishing site helps get it taken down — the UK’s National Cyber Security Centre says reports to its service have led to hundreds of thousands of scam web addresses being removed.
How to Report a Royal Mail Scam Text
- Forward the text to 7726. This is free on UK networks and reports the message to your mobile provider, which shares the data to help block scam texts. Royal Mail’s own guidance recommends this.
- Email Royal Mail directly. Send a screenshot of the message to reportascam@royalmail.com — that’s Royal Mail’s dedicated address for scam emails, texts, calls, and fake websites. Include the sender’s number or the website address.
- Report fraud to Action Fraud. If you’ve lost money or shared financial details, report it to Action Fraud (actionfraud.police.uk), the UK’s national fraud reporting centre. In Scotland, report to Police Scotland on 101.
- Forward scam emails to the NCSC. Got the scam by email instead? Forward it to report@phishing.gov.uk, the National Cyber Security Centre’s Suspicious Email Reporting Service.
- In the US? Report to the FTC at ReportFraud.ftc.gov and the FBI at ic3.gov — delivery-fee smishing runs there too, usually impersonating USPS, FedEx, or UPS. For the full breakdown, see the USPS text scam running the same playbook in the US.
Sources
- Royal Mail, “Scams, fraud and identity theft — how to spot and report an issue” (official guidance: reportascam@royalmail.com, forward texts to 7726) — https://help.royalmail.com/business/s/article/Scams-fraud-and-identity-theft-how-to-spot-and-report-an-issue
- Beat the Scam, “Royal Mail Scam Texts: Spot a Fake Delivery Text (UK)” — https://beatthescam.com/guides/royal-mail-text-scam-uk/
- ScanLens, “Royal Mail Scam Text: Check Fake Delivery Fee Links” (cites official guidance) — https://scanlens.app/royal-mail-scam.html
- InYourArea, “Royal Mail urges people to be ‘vigilant’ over authentic text scam” — https://www.inyourarea.co.uk/news/royal-mail-urges-people-to-be-vigilant-over-authentic-text-scam/
- JustGilbey, “Phishing and Email Scams: How to Spot Them (UK Guide)” — reporting routes: 7726, report@phishing.gov.uk, Action Fraud — https://justgilbey.co.uk/blog/guides/phishing-and-email-scams/
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.
Pingback: USPS Text Scam: Fake 'Undeliverable Package' Messages Explained - Warn Scams